Vulnerability in Linux

CVE-2026-46266

In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST") pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner "man 7 raw" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (51.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-46266: held from 0.003 to 0.007.

EPSS over last 30 days · oldest: 0.003 · newest: 0.007 · change: +0.004

Affected products

  • Linux — versions 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 2.6.12, 0
  • Linux Kernel — versions 2.6.12

References

Frequently asked questions

What is CVE-2026-46266?
CVE-2026-46266 is a critical-severity vulnerability in Linux. CVSS score: 9.1/10. Published 2026-06-03.
How severe is CVE-2026-46266?
Critical severity. CVSS v3 base score is 9.1 out of 10.